summaryrefslogtreecommitdiff
path: root/lib/webrick/httpauth
AgeCommit message (Collapse)Author
2019-10-01merge revision(s) 36e057e26ef2104bc2349799d6c52d22bb1c7d03usa
Loop with String#scan without creating substrings Create the substrings necessary parts only, instead of cutting the rest of the buffer. Also removed a useless, probable typo, regexp. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@67818 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28merge revision(s) 62960,62961,62962,62963,62964,62965:nagachika
webrick/httprequest: limit request headers size We use the same 112 KB limit started (AFAIK) by Mongrel, Thin, and Puma to prevent malicious users from using up all the memory with a single request. This also limits the damage done by excessive ranges in multipart Range: requests. Due to the way we rely on IO#gets and the desire to keep the code simple, the actual maximum header may be 4093 bytes larger than 112 KB, but we're splitting hairs at that point. * lib/webrick/httprequest.rb: define MAX_HEADER_LENGTH (read_header): raise when headers exceed max length webrick/httpservlet/cgihandler: reduce memory use WEBrick::HTTPRequest#body can be passed a block to process the body in chunks. Use this feature to avoid building a giant string in memory. * lib/webrick/httpservlet/cgihandler.rb (do_GET): avoid reading entire request body into memory (do_POST is aliased to do_GET, so it handles bodies) webrick/httprequest: raise correct exception "BadRequest" alone does not resolve correctly, it is in the HTTPStatus namespace. * lib/webrick/httprequest.rb (read_chunked): use correct exception * test/webrick/test_httpserver.rb (test_eof_in_chunk): new test webrick/httprequest: use InputBufferSize for chunked requests While WEBrick::HTTPRequest#body provides a Proc interface for streaming large request bodies, clients must not force the server to use an excessively large chunk size. * lib/webrick/httprequest.rb (read_chunk_size): limit each read and block.call to :InputBufferSize in config. * test/webrick/test_httpserver.rb (test_big_chunks): new test webrick: add test for Digest auth-int No changes to the actual code, this is a new test for a feature for which no tests existed. I don't understand the Digest authentication code well at all, but this is necessary for the subsequent change. * test/webrick/test_httpauth.rb (test_digest_auth_int): new test (credentials_for_request): support bodies with POST webrick/httpauth/digestauth: stream req.body WARNING! WARNING! WARNING! LIKELY BROKEN CHANGE Pass a proc to WEBrick::HTTPRequest#body to avoid reading a potentially large request body into memory during authentication. WARNING! this will break apps completely which want to do something with the body besides calculating the MD5 digest of it. Also, keep in mind that probably nobody uses "auth-int". Servers such as Apache, lighttpd, nginx don't seem to support it; nor does curl when using POST/PUT bodies; and we didn't have tests for it until now... * lib/webrick/httpauth/digestauth.rb (_authenticate): stream req.body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@63004 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-21lib/*: remove closed checksnormal
Follow r56795. Since Ruby 2.2, calling #close on a closed socket no longer raises exceptions. * lib/cgi/session.rb (update): remove closed? check * lib/net/http.rb (finish, transport_request): ditto * lib/net/imap.rb (disconnect): ditto * lib/net/pop.rb (do_start, do_finish): ditto * lib/net/smtp.rb (do_start, do_finish): ditto * lib/open3.rb (popen_run, pipeline_run): ditto * lib/pstore.rb (transaction): ditto * lib/shell/process-controller.rb (sfork): * lib/tempfile (_close, call, Tempfile.create): ditto * lib/webrick/httpauth/htdigest.rb (flush): ditto * lib/webrick/httpauth/htpasswd.rb (flush): ditto * lib/webrick/server.rb (start_thread, cleanup_shutdown_pipe): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56865 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-08-30Use qualified namesnobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56037 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-01-10stdlib: avoid extra calls to eliminate "\n" from Base64normal
We may use the '0' (zero) to avoid adding the line feed. Furthermore, the '*' (asterisk) modifier is not needed for a single-element arrays. * ext/psych/lib/psych/visitors/yaml_tree.rb (visit_String): eliminate chomp * lib/net/http.rb (connect): eliminate delete * lib/net/http/header.rb (basic_encode): ditto * lib/net/imap.rb (authenticate): eliminate gsub (self.encode_utf7): shorten delete arg * lib/net/smtp.rb (base64_encode): eliminate gsub * lib/open-uri.rb (OpenURI.open_http): eliminate delete * lib/rss/rss.rb: ditto * lib/securerandom.rb (base64): ditto (urlsafe_base64): eliminate delete! * lib/webrick/httpauth/digestauth.rb (split_param_value): eliminate chop * lib/webrick/httpproxy.rb (do_CONNECT): eliminate delete (setup_upstream_proxy_authentication): ditto [ruby-core:72666] [Feature #11938] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53488 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2015-12-16Add frozen_string_literal: false for all filesnaruse
When you change this to true, you may need to add more tests. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53141 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2015-11-16* lib/webrick/httpauth/basicauth.rb: fix a typo.hsbt
[ci skip][fix GH-1099] Patch by @jwworth * lib/webrick/httpauth/digestauth.rb: ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@52581 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2013-11-29* lib/webrick/httpauth/digestauth.rb: Fix typo in an error message.a_matsuda
* test/ruby/test_parse.rb: Fix typo in a test name. s/allowd/allowed/ git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@43917 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2013-04-20* lib/webrick/httpauth/htpasswd.rb: Use Tempfile.create to avoidakr
unintentional unlink() by the finalizer. lib/webrick/httpauth/htdigest.rb: Ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40395 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2013-01-26* lib/webrick/accesslog.rb: Improved WEBrick documentation.drbrain
* lib/webrick/cgi.rb: ditto. * lib/webrick/config.rb: ditto. * lib/webrick/cookie.rb: ditto. * lib/webrick/httpauth/authenticator.rb: ditto. * lib/webrick/httpauth/basicauth.rb: ditto. * lib/webrick/httpauth/digestauth.rb: ditto. * lib/webrick/httpproxy.rb: ditto. * lib/webrick/httprequest.rb: ditto. * lib/webrick/httpresponse.rb: ditto. * lib/webrick/https.rb: ditto. * lib/webrick/httpserver.rb: ditto. * lib/webrick/httpservlet/cgihandler.rb: ditto. * lib/webrick/httpservlet/filehandler.rb: ditto. * lib/webrick/httpservlet/prochandler.rb: ditto. * lib/webrick/httputils.rb: ditto. * lib/webrick/httpversion.rb: ditto. * lib/webrick/log.rb: ditto. * lib/webrick/server.rb: ditto. * lib/webrick/ssl.rb: ditto. * lib/webrick/utils.rb: ditto. * lib/webrick/version.rb: ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@38945 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2011-07-05* lib/webrick/httpauth/digestauth.rb (_authenticate):naruse
Literal texts in HTTP ABNF is case-insensitive (RFC2616 2.1), and a ample implementation in RFC2617 also ignores the case of algorithms. So now this ignores those cases. [ruby-dev:43965] [Feature #4936] * lib/webrick/httpauth/digestauth.rb (initialize): Because of above, opera_hack is useless and removed. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@32410 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2011-05-11 * lib/csv.rb: fix a typo.nagachika
* lib/logger.rb: ditto * lib/rss.rb: ditto * lib/webrick/httpauth/authenticator.rb: ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@31506 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2011-05-10 * lib/webrick: Add documentation for WEBrick::HTTPAuthdrbrain
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@31505 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2011-05-09 * lib/webrick/log.rb: Hide copyright info from ridrbrain
* lib/webrick/httpstatus.rb: ditto * lib/webrick/htmlutils.rb: ditto * lib/webrick/httpversion.rb: ditto * lib/webrick/version.rb: ditto * lib/webrick/httpauth/userdb.rb: ditto * lib/webrick/httpauth/authenticator.rb: ditto * lib/webrick/accesslog.rb: ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@31497 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2010-10-21* lib/webrick/httpauth/digestauth.rbnaruse
(WEBrick::HTTPAuth::ProxyDigestAuth#check_uri): privated. [ruby-dev:42344] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@29546 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2010-09-11Add documentation for WEBrick's DigestAuthdrbrain
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@29224 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2009-10-20 * lib/webrick/httpauth/digestauth.rb: typo in exception message fixed.nahi
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@25415 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2009-03-06* {ext,lib,test}/**/*.rb: removed trailing spaces.nobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@22784 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2008-11-08* lib/webrick/httpproxy.rb (WEBrick::HTTPProxyServer#do_CONNECT):matz
use #bytesize instead of #size. a patch submitted from raspberry lemon in [ruby-core:18571]. * lib/webrick/httpauth/digestauth.rb, lib/webrick/httpproxy.rb, lib/webrick/httprequest.rb, lib/webrick/httpservlet/cgi_runner.rb, lib/webrick/httpservlet/abstract.rb, lib/webrick/httpresponse.rb, lib/webrick/httpservlet/cgihandler.rb, lib/webrick/utils.rb: ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@20152 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2008-10-31* lib/webrick/httpauth/digestauth.rbmame
(WEBrick::HTTPAuth::DigestAuth#initialize): fix typo. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@20078 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2007-07-04 * lib/webrick/httpauth/authenticator.rbnahi
(WEBrick::HTTPAuth::Authenticator#check_scheme): auth-scheme must be treated as a case-insensitive token according to RFC 2617 section 1.2. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@12692 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2005-07-03cosmetic.nahi
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@8711 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2005-01-02* lib/webrick/httpauth/htpasswd.rb (WEBrick::Htpasswd#reload):gotoyuzo
raise NotImplementedError if password is encrypted by digest algorithms. This patch is contributed by sheepman. [ruby-list:40467] * lib/webrick/httpauth/digestauth.rb (WEBrick::HTTPAuth::DigestAuth#_authenticate): fix digest calculation. This patch is contributed by sheepman. [ruby-list:40482] * lib/webrick/{httpauth.rb,httpauth/basicauth.rb,httpproxy.rb}: use pack/unpack-template char "m" instead of lib/base64.rb to do base64 encoding/decoding. fixed: [ruby-dev:25336] * test/webrick/test_httpauth.rb: new file. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@7708 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2004-12-18 * lib/webrick/httpauth.rb,nahi
lib/webrick/httpauth/{basicauth.rb,digestauth.rb}: use pack/unpack-template char "m" instead of lib/base64.rb to do base64 encoding/decoding. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@7593 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2004-11-03* lib/webrick/httpauth/digestauth.rb: use Base64.encode64 togotoyuzo
avoid warnings. [webrickja:128] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@7192 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2003-07-23* lib/webrick: imported.gotoyuzo
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@4130 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-16 09:07:19 +0000